In the Linux kernel, the following vulnerability has been resolved: statmount: read the parent of an unmounted mount under mount_lock… (CVE-2026-98994)

The vulnerability involves statmount_mnt_basic() in the Linux kernel reading the parent mount of an unmounted mount while holding mount_lock. Normally, mounts are pinned by their namespace, preventing them from being freed during access. However, when a mount is unmounted but kept alive solely by a file descriptor, its parent may also be unmounted and freed concurrently. The function reads m->mnt_parent twice without adequate locking, which can lead to dereferencing a mount that has already been freed. This race condition was addressed by ensuring proper synchronization when accessing parent mounts of unmounted mounts.

This vulnerability could lead to use-after-free conditions in the Linux kernel, potentially causing kernel crashes or memory corruption. The description does not specify exploitation in the wild or direct privilege escalation, but kernel memory corruption can have serious stability and security implications.

A fix has been applied to the Linux kernel to resolve this issue. Users and administrators should update to the fixed kernel versions once available. Since no specific patch links or affected versions are provided, check the official Linux kernel advisories for the relevant updates.